Skip to content

Commit e1502fb

Browse files
committed
fix(wifi): Avoid dereferencing a dangling function pointer in WPS supplicant
Avoid dereferencing a dangling function pointer in 'eap_server_sm_deinit()'. This issue arises when hostap unregisteres EAP methods before it removes the server state machine for station.
1 parent 7d16878 commit e1502fb

File tree

1 file changed

+13
-0
lines changed

1 file changed

+13
-0
lines changed

components/wpa_supplicant/src/ap/wps_hostapd.c

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -321,6 +321,14 @@ int hostapd_init_wps(struct hostapd_data *hapd, struct wps_data *wps_data, struc
321321
return -1;
322322
}
323323

324+
#ifdef ESP_SUPPLICANT
325+
static int ap_sta_server_sm_deinit(struct hostapd_data *hapd,
326+
struct sta_info *sta, void *ctx)
327+
{
328+
ieee802_1x_free_station(hapd, sta);
329+
return 0;
330+
}
331+
#endif /* ESP_SUPPLICANT */
324332

325333
void hostapd_deinit_wps(struct hostapd_data *hapd)
326334
{
@@ -332,6 +340,11 @@ void hostapd_deinit_wps(struct hostapd_data *hapd)
332340
}
333341
wps_registrar_deinit(hapd->wps->registrar);
334342
hapd->wps->registrar = NULL;
343+
344+
#ifdef ESP_SUPPLICANT
345+
ap_for_each_sta(hapd, ap_sta_server_sm_deinit, NULL);
346+
#endif /* ESP_SUPPLICANT */
347+
335348
eap_server_unregister_methods();
336349
hapd->wps = NULL;
337350
hostapd_wps_clear_ies(hapd, 1);

0 commit comments

Comments
 (0)